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—The MAILING DATE of this communication appears on the cover sheet beneath the correspondence address- 
Period for Response 

A SHORTENED STATUTORY PERIOD FOR RESPONSE IS SET TO EXPIRE^ 6^ ^ ) MONTH(S) FROM THE 
MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a). In no event, however, may a response be timely filed after SIX (6) MONTHS 
from the mailing date of this communication. 

- If the period for response specified above is less than thirty (30) days, a response within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for response is specified above, such period shall, by default, expire SIX (6) MONTHS from the mailing date of this communication . 

- Failure to respond within the set or extended period for response will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

Status 

□ Responsive to communication(s) filed on 

□ This action is FINAL 

^Since this application is in condition for allowance except for formal matters, prosecution as to the merits is closed in 
accordance with the practice under Ex parte Quayle, 1935 CD. 1 1; 453 O.G. 213. 

Disposition of Claims 

>gf Claim(s) . is/are pending in the application. 

Of the above claim(s) is/are withdrawn from consideration. 

^ Claim(s). is/are allowed. 

□ Claim(s) is/are rejected. 

□ Claim(s) is/are objected to. 

□ Claim(s) are subject to restriction or election 

requirement. 

Application Papers 

y§ See the attached Notice of Draftsperson's Patent Drawing Review, PTO-948. 

□ The proposed drawing correction, filed on is □ approved □ disapproved. 

□ The drawing(s) filed on is/are objected to by the Examiner. 

□ The specification is objected to by the Examiner. 

□ The oath or declaration is objected to by the Examiner. 

Priority under 35 U.S.C. § 119 (a)-(d) 

□ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 11 9(a)-(d). 

□ All □ Some* □ None of the CERTIFIED copies of the priority documents have been 

□ received. 

□ received in Application No. (Series Code/Serial Number) . 

□ received in this national stage application from the International Bureau (PCT Rule 1 7.2(a)). 

'Certified copies not received: . 



Attachment(s) / 

^Information Disclosure Statement(s), P^O-1449, Paper No(s). _Z □ Interview Summary, PTO-413 

)?f Notice of References Cited, PTO-892 □ Notice of Informal Patent Application, PTO-1 52 

Notice of Draftsperson's Patent Drawing Review, PTO-948 □ Other 
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Application/Control Number: 09/188,739 Page 2 

Art Unit: 2182 



1. The drawings are objected to as failing to comply with 37 
CFR 1.84 (p) (5) because they do not include the following 
reference sign(s) mentioned in the description: reference number 
*10" for Fig. 1 as indicated on page 5 line 19. Correction is 
required. 



2. This application contains an appendix consisting of a 
computer program listing of more than ten (10) pages. In 
accordance with 37 CFR 1.96(c), a computer program listing 
contained on more than ten (10) pages, must be submitted as a 
'microfiche appendix" conforming to the standards set forth in 37 
CFR 1.96(c) (2) and must be appropriately referenced in the 
specification (see 37 CFR 1.77(a)(6)). Accordingly, applicant is 
required to cancel the computer program listing appearing in the 
current appendix to the specification, file a 'microfiche 
appendix" in compliance with 37 CFR 1.96(c), and insert an 
appropriate reference to the newly added 'microfiche appendix" at 
the beginning of the specification. 



3. Claims 1-27 are allowed. 
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4. The following is an examiner's statement of reasons for 
allowance: the prior art does not teach a method for network 
surveillance comprising receiving network packets, building at 
least one long-term and short-term statistical profile based on 
the received packets, comparing at least one long-term and short- 
term profile to determine whether the packets indicate suspicious 
network activity. 

Any comments considered necessary by applicant must be 
submitted no later than the payment of the issue fee and, to 
avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

5. As allowable subject matter has been indicated, applicant's 
reply must either comply with all formal requirements or 
specifically traverse each requirement not complied with. See 37 
CFR 1.111 (b) and MPEP § 707.07 (a) . 

6. Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Tom 
Heckler whose telephone number is (703) 305-9666. 
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Any inquiry of a general nature or relating to the status of 
this application should be directed to the Technology Center 
receptionist whose telephone number is (703) 305-3900. 
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THOMAS M. HECKLER 
PRIMARY EXAMINER 



